From d14d8c07bdceeae8bd2701ed467563839419a6c1 Mon Sep 17 00:00:00 2001 From: Valentin Haudiquet Date: Sat, 31 Oct 2026 18:27:48 -0500 Subject: [PATCH] build: move the entitlements next to the Homebrew formula All consumers live in packaging already: the formula codesigns at install, and the CI and release workflows codesign the built binary. The macOS dir held nothing else. --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- SPEC.md | 2 +- packaging/homebrew/Formula/ecrou.rb | 6 +++--- packaging/{macos => homebrew}/ecrou.entitlements | 0 5 files changed, 6 insertions(+), 6 deletions(-) rename packaging/{macos => homebrew}/ecrou.entitlements (100%) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a947001..4596da2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -71,7 +71,7 @@ jobs: # HVF grants VM creation only to binaries carrying the hypervisor # entitlement on current macOS; packaging signs the same way. - name: Sign the binary with the hypervisor entitlement - run: codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou + run: codesign --force --sign - --entitlements packaging/homebrew/ecrou.entitlements target/release/ecrou - name: Probe run: ./target/release/ecrou probe diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 549e7f9..841cfb9 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -87,7 +87,7 @@ jobs: run: cargo build --release -p ecrou-cli - name: Sign the binary with the hypervisor entitlement - run: codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou + run: codesign --force --sign - --entitlements packaging/homebrew/ecrou.entitlements target/release/ecrou - name: Package run: | diff --git a/SPEC.md b/SPEC.md index 55ed6c4..cb2bdd6 100644 --- a/SPEC.md +++ b/SPEC.md @@ -342,7 +342,7 @@ the release tarball and pushes it (gated on a `HOMEBREW_TAP_TOKEN` PAT; without the secret the job no-ops). The formula carries the runtime dependencies (`libkrun` from the krun tap, `e2fsprogs`, `libarchive`), builds from source with cargo, and re-signs the binary with the -entitlements plist from `packaging/macos/` — brew bottles are +entitlements plist from `packaging/homebrew/` — brew bottles are ad-hoc signed, so the signature is part of the formula's install, not of the artifact. The formula is pinned by tag until the first release exists, then switches to the release tarball + sha256 the diff --git a/packaging/homebrew/Formula/ecrou.rb b/packaging/homebrew/Formula/ecrou.rb index c82f702..93d78f8 100644 --- a/packaging/homebrew/Formula/ecrou.rb +++ b/packaging/homebrew/Formula/ecrou.rb @@ -3,7 +3,7 @@ # krunkit comes from, because the engine is dlopen'd from those kegs # at runtime. class Ecrou < Formula - desc "One-shot microVM environments" + desc "a small microVM runtime based on libkrun" homepage "https://github.com/vhaudiquet/ecrou" # Pinned by tag until the first release exists; switch to the # release tarball + sha256 then. @@ -26,14 +26,14 @@ class Ecrou < Formula # with the hypervisor entitlement; on current macOS the signature # is a hard requirement, the same one krunkit's formula carries. system "codesign", "--force", "--sign", "-", - "--entitlements", "packaging/macos/ecrou.entitlements", bin/"ecrou" + "--entitlements", "packaging/homebrew/ecrou.entitlements", bin/"ecrou" end def caveats <<~EOS The binary is ad-hoc signed with the com.apple.security.hypervisor entitlement. Rebuilding from source (cargo) requires re-signing: - codesign --force --sign - --entitlements packaging/macos/ecrou.entitlements target/release/ecrou + codesign --force --sign - --entitlements packaging/homebrew/ecrou.entitlements target/release/ecrou `ecrou probe` reports this when the entitlement is missing. EOS end diff --git a/packaging/macos/ecrou.entitlements b/packaging/homebrew/ecrou.entitlements similarity index 100% rename from packaging/macos/ecrou.entitlements rename to packaging/homebrew/ecrou.entitlements